Mythos, the AI too dangerous for you: curiosities about the model that's still locked down

The AI you're not allowed to use (and why that should matter to you)

Mythos has been all over the news these past two weeks, almost always for the same two reasons: that the US government ordered it shut down and that it finds 27-year-old flaws in your kernel. We've covered both. But underneath the headlines there's a pile of details almost nobody has read, and they're far more interesting than yet another benchmark race.

Let's start with the fact that sums up the whole situation: as of today, Mythos is still locked down. For everyone, not just for you. The government's export-control directive bars access by any foreign national —yes, that includes you, reading this outside the US, since as far as Washington is concerned you're a foreign national—. But here's the catch: Anthropic can't sort its users by nationality overnight, so to comply with the order it has had to switch the model off for all of them: US customers included, and even its own foreign employees. The most powerful cybersecurity model on the planet exists, it works… and right now nobody gets to touch it.

Here are the curiosities you probably didn't know. And fair warning: this builds.

Cloudflare ran it against its own code… and admits it's a monster

Let's open strong. Cloudflare —one of the backbones of the internet, the layer millions of websites pass through— did something almost nobody would dare to: it turned Mythos loose on more than fifty of its production repositories. Their actual code, the kind that holds up half the web.

They went in skeptical. They came out with a different face. Because what the model did with that code wasn't flag a few isolated bugs: it took flaws that normally rot away in a backlog, tagged "low priority, not exploitable," and stitched them into a single high-severity exploit. And not once: ten documented cases where it seized full control of the program's execution flow —the holy grail for any attacker— across runtimes, edge data paths and protocol stacks.

How do they describe it themselves? Its reasoning "looks like the work of a senior researcher rather than the output of an automated scanner." Let's be clear: not a tool that spits out alerts. A senior researcher. No breaks, no coffee, at a speed no flesh-and-blood human can sustain.

It doesn't "find flaws": it hands you the exploit, assembled and working

Cloudflare nails it in one line: "finding a bug and proving it's exploitable are two different things, and Mythos can do both." A classic scanner stops at the first half —"this looks vulnerable, you figure it out"—. Mythos does the second: it writes the code that triggers the bug, compiles it, runs it, reads the failure if it doesn't work, adjusts it and tries again until the exploit genuinely works.

The practical fallout? Brutal: a finding with a working exploit attached is a finding you act on immediately. No more "we should look into this someday." The proof comes pre-assembled, smoking gun on the table.

It's the best in the world at this, by a wide margin

So it doesn't stay a gut feeling: on cybersecurity benchmarks Mythos scores 83.1%, against 66.6% for the previous model from the same company. That's not an incremental bump, it's a whole tier up. Anthropic markets it bluntly as "the strongest cybersecurity capabilities of any model in the world," and so far nobody has challenged the title.

Taming it isn't black magic (you still need a brain)

Let's let some air out for a second, because it's not all apocalypse. Using Mythos for real isn't a one-click affair: Cloudflare had to wrap it in a harness that narrowed its scope, add a second agent to separate signal from noise, and split the work across several agents in parallel, each with a specific task. A handful of specialized "workers" outperforms a single super-worker trying to swallow the whole codebase.

In other words: today you still need a competent team behind it to extract the full juice. The bad news is how fast that barrier is dropping.

It doesn't stop at one flaw: it walks the whole attack

And here we climb a rung. What really unsettles isn't that it finds a hole, it's that it walks the full attack cycle —reconnaissance, discovery, lateral movement and exploit development— the way the best human attacker would. It steals a credential in one corner, uses it to slip into an unrelated service, finds a forgotten byte sitting at zero and flips it to one, and from there jumps to the next link. And the next.

It has a name —agentic hacking— and a difference that changes everything: it does it at a scale and speed no human team can match. It doesn't need to think forty moves ahead like in chess; it simply never tires, never sleeps and tries a thousand paths at once.

It found serious memory bugs… and refused to prove them

The most surreal detail of the whole affair. In one case, Mythos found and confirmed serious memory bugs and then refused to write the demonstration exploit —until the request was reworded; then it complied—. In another, it declined to audit a project and agreed to do the exact same work, on the same code, after an unrelated change to the environment.

Cloudflare's verdict is the kind that sticks: these refusals "are real, but they aren't a safety boundary on their own." Translation: a tool whose entire reason for existing is preventive hardening censors itself at random… and the brake is dodged by changing two words. It neither fully protects nor fully cooperates.

As of today you can't use it. And the reason is a farce

We close the curiosities where we started, but now we know what we're dealing with. What exactly spooked the government enough to pull the plug? A jailbreak that consisted, quite literally, of asking the model to read some source code and fix its security flaws. That is: precisely what it's designed for. (We told the full timeline of that shutdown here.)

And one note so nobody dozes off: when a model like this ships, recent history says an open-source equivalent shows up within months —and that one doesn't come with the safety brakes baked in—. The official version being locked down doesn't put the capability back in the box. It only delays the day everyone has it.

And now for what really matters

That's it for the curiosities. But if you take home a single paragraph, make it this one, because it's where Cloudflare stops explaining and drops the real warning:

"The same capabilities that helped us find bugs in our own code will, in the wrong hands, accelerate the attack side against every application on the Internet."

Read it again. Every application on the Internet. Not Cloudflare's: yours too. Put plainly, without the corporate filter: we're in serious trouble if this falls into the wrong hands. And in case anyone thought they'd escape by just patching faster, they shut that door without mercy:

"Faster is not going to be enough, and we think a lot of teams are about to spend a lot of time, effort, and money learning that the hard way."

And here's where your twelve-year-old server comes in

Now put the two pieces together. On one side, a machine that can stitch invisible bugs into working exploits against any code. On the other, that Debian or Ubuntu you installed ten or twelve years ago, the VPS that's "been running untouched" and that you assumed was bulletproof precisely because in a decade nobody ever found anything in it.

That "nobody ever found anything" was your entire defense. And it's exactly the one that just evaporated. What kept you safe wasn't that server's strength: it was that scanning it with a magnifying glass was expensive and slow. That's over. (We go deep into that forgotten server —and how to bring it up to date without breaking anything— in its own article.)

The recommendation, no hedging

The tool changes, but the conclusion doesn't budge, it just gets more urgent: what protects you isn't the obscurity of your code, it's your discipline in updating it. It doesn't matter that Mythos is locked down: the capability exists, it's been proven against real infrastructure, and one way or another it'll get loose. Whoever already kept their servers current can keep reading calmly. Whoever was going to do it "when I get around to it" just ran out of excuses.

If your infrastructure leans on machines nobody has touched in years, this is the moment —not next month— to bring them up to date. And if you don't know where to start, that's what we're here for: let's talk before someone who shouldn't takes a look.

References

• The cyber frontier: testing Claude Mythos against our own code — Cloudflare
• Cloudflare says Claude Mythos reasoning 'looks like the work of a senior researcher' — PC Gamer
• Cloudflare Finds Claude Mythos Can Discover Complicated Exploit Chains, But Also Inconsistently Refuses Some Tasks — OfficeChai
• U.S. Orders Anthropic to Suspend Fable 5 and Mythos 5 Access for Foreign Nationals — The Hacker News
• Anthropic disables Fable and Mythos AI models after U.S. government bars foreign access — Fortune
• Claude Fable 5 and Claude Mythos 5 — Anthropic